View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009165 | Taler | merchant-pos-terminal (Android App) | public | 2024-09-03 14:30 | 2024-12-13 18:15 |
| Reporter | mikolai | Assigned To | avalos | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | reopened | ||
| Target Version | 0.14 | Fixed in Version | 0.14 | ||
| Summary | 0009165: Do not show password in the settings screen (only on password change) | ||||
| Description | Anyone with access to a configured POS terminal can currently easily obtain the password (secret-token) of the merchant backend instance. With that information, they can login to the merchant SPA and do harmful things, e.g., change the connected bank account. An easy fix would be to not allow to reveal the current password by either disabling the toggle or showing (current) or something similar instead. We would need that functionality for the Datenspuren event, and wouldn't mind having it on a separate branch if the current behavior should stay on master. I wouldn't see proper reasons for that, though. | ||||
| Tags | No tags attached. | ||||
| In my opinion, access to the PoS (or any authenticated device, for that matter) should always be supervised. The ideal fix here would be for the merchant backend to provide multiple tokens with different levels of access for a single instance, effectively making it possible to restrict a PoS token from modifying the bank account or doing any modifications in the inventory. However, if what you are planning is to leave your terminals unsupervised at the event, I can implement the toggle, sure. | |
| Enjoy! commit 0310be19806ee821261947afb90e40fe14e1aa70 (HEAD -> master, origin/master) Author: Iván Ávalos <avalos@disroot.org> Date: Thu Sep 5 21:36:50 2024 +0200 [pos] "Remember password" now empties password field when unchecked | |
| Thanks for the fix, just tried it out with the nightly and it works, but with the following caveat: If the app is closed, the configuration is forgotten and you have to re-type the password (obviously, because I told it to forget the password). Wouldn't it have been possible to make this independent of the "remember password" option and save the password if requested, but just don't show it back to the user when opening the settings screen? basically disabling the "show password" toggle in that case. | |
| It is not trivial to do, as the system provided TextField doesn't expose this functionality of hiding the visibility toggle. | |
| Fixed in version 0.2.7, now the password hides even when “Save password” is checked, the only difference when the toggle is unchecked is that the session won't be restored in the next launch and the user will need to type it again. I hope that this satisfies the Datenspuren requirements. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-09-03 14:30 | mikolai | New Issue | |
| 2024-09-03 14:30 | mikolai | Status | new => assigned |
| 2024-09-03 14:30 | mikolai | Assigned To | => avalos |
| 2024-09-05 18:47 | avalos | Note Added: 0023188 | |
| 2024-09-05 19:37 | avalos | Status | assigned => informing |
| 2024-09-05 19:37 | avalos | Resolution | open => fixed |
| 2024-09-05 19:37 | avalos | Note Added: 0023191 | |
| 2024-09-06 05:15 | mikolai | Status | informing => feedback |
| 2024-09-06 05:15 | mikolai | Resolution | fixed => reopened |
| 2024-09-06 05:15 | mikolai | Note Added: 0023199 | |
| 2024-09-06 06:33 | avalos | Note Added: 0023202 | |
| 2024-09-09 07:10 | Christian Grothoff | Status | feedback => assigned |
| 2024-09-09 07:56 | Christian Grothoff | Target Version | => 0.14 |
| 2024-09-13 09:54 | avalos | Status | assigned => informing |
| 2024-09-13 09:54 | avalos | Note Added: 0023283 | |
| 2024-09-13 23:08 | Christian Grothoff | Fixed in Version | => 0.14 |
| 2024-12-13 18:15 | Christian Grothoff | Status | informing => closed |